@runeya/runeya 2.0.14 → 2.0.18

package/{dist-TI3HFRUW.js → dist-CJTJWMCR.js}

@@ -34,7 +34,7 @@ import {
   nativeParsers,
   serviceStore,
   traefikManager
-} from "./chunk-AJW7LDO5.js";
+} from "./chunk-AHOJAT74.js";
 import {
   generateKanbanPopulatePrompt,
   generateKanbanSystemPrompt,
@@ -177,34 +177,38 @@ import { EventEmitter as EventEmitter3 } from "events";
 import { z as z20 } from "zod";
 import { TRPCError as TRPCError17 } from "@trpc/server";
 import { z as z21 } from "zod";
-import { chmod as chmod8, stat as stat3 } from "fs/promises";
-import { join as join14 } from "path";
-import { writeFile as writeFile10 } from "fs/promises";
+import { z as z22 } from "zod";
+import { TRPCError as TRPCError18 } from "@trpc/server";
+import { readFile as readFile12, readdir as readdir4, stat as stat3, realpath, writeFile as writeFile10, mkdir as mkdir13, rename as rename9, rm as rm2 } from "fs/promises";
+import { resolve as resolvePath, join as join14, relative, sep as sep3, dirname as dirname3 } from "path";
+import { chmod as chmod8, stat as stat4 } from "fs/promises";
 import { join as join15 } from "path";
+import { writeFile as writeFile11 } from "fs/promises";
+import { join as join16 } from "path";
 import { createRequire } from "module";
 import { randomBytes as randomBytes3, createCipheriv, createDecipheriv } from "crypto";
 import { randomUUID as randomUUID10 } from "crypto";
 import {
-  readFile as readFile12,
-  writeFile as writeFile11,
-  rename as rename9,
-  mkdir as mkdir13,
+  readFile as readFile13,
+  writeFile as writeFile12,
+  rename as rename10,
+  mkdir as mkdir14,
   access as access2,
-  readdir as readdir4
+  readdir as readdir5
 } from "fs/promises";
-import { join as join16 } from "path";
-import { randomBytes as randomBytes4, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "crypto";
-import { readFile as readFile13, writeFile as writeFile12, chmod as chmod9, stat as stat4, rename as rename10 } from "fs/promises";
 import { join as join17 } from "path";
+import { randomBytes as randomBytes4, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "crypto";
+import { readFile as readFile14, writeFile as writeFile13, chmod as chmod9, stat as stat5, rename as rename11 } from "fs/promises";
+import { join as join18 } from "path";
 import { Entry } from "@napi-rs/keyring";
 import { hashRaw as argon2HashRaw } from "@node-rs/argon2";
-import { join as join18 } from "path";
-import { stat as stat5 } from "fs/promises";
+import { join as join19 } from "path";
+import { stat as stat6 } from "fs/promises";
 import rateLimit from "express-rate-limit";
 import { existsSync as existsSync2, createReadStream } from "fs";
-import { mkdir as mkdir14 } from "fs/promises";
+import { mkdir as mkdir15 } from "fs/promises";
 import multer from "multer";
-import { resolve as resolvePath } from "path";
+import { resolve as resolvePath2 } from "path";
 import dotenv from "dotenv";
 var jwtSecret = null;
 var jwtSecretGeneratedAt = 0;
@@ -408,7 +412,7 @@ function requireEnvAction(ctx, environmentId, action, serviceId) {
   });
 }
 var startedAt = Date.now();
-var appVersion = process.env["RUNEYA_VERSION"] ?? (true ? "2.0.14" : "dev");
+var appVersion = process.env["RUNEYA_VERSION"] ?? (true ? "2.0.16" : "dev");
 var healthRouter = router({
   check: publicProcedure.meta({ openapi: { method: "GET", path: "/health", tags: ["health"], summary: "Health check" } }).output(z.object({ status: z.literal("ok"), uptime: z.number(), version: z.string() })).query(() => {
     return {
@@ -1332,6 +1336,7 @@ var serviceRouter = router({
       ports: z3.array(z3.number().int().min(1).max(65535)).max(20).optional(),
       groups: z3.array(z3.string().max(200)).max(20).optional(),
       description: z3.string().max(2e3).optional(),
+      docsPath: z3.string().max(4096).optional(),
       url: z3.string().max(2048).optional(),
       localUrls: z3.array(z3.object({
         url: z3.string().max(253),
@@ -1382,6 +1387,7 @@ var serviceRouter = router({
       ports: z3.array(z3.number().int().min(1).max(65535)).max(20).optional(),
       groups: z3.array(z3.string().max(200)).max(20).optional(),
       description: z3.string().max(2e3).optional(),
+      docsPath: z3.string().max(4096).optional(),
       url: z3.string().max(2048).optional(),
       localUrls: z3.array(z3.object({
         url: z3.string().max(253),
@@ -2230,7 +2236,7 @@ var settingsRouter = router({
   /**
    * Update settings (mode, cloudUrl)
    */
-  update: protectedProcedure.input(SettingsSchema.pick({ mode: true, cloudUrl: true }).partial()).mutation(async ({ input }) => {
+  update: protectedProcedure.input(SettingsSchema.pick({ mode: true, cloudUrl: true, globalDocsPath: true }).partial()).mutation(async ({ input }) => {
     const current = await settingsManager.getSettings();
     const updated = {
       ...current,
@@ -5070,7 +5076,7 @@ function tailTranscript(opts) {
   };
 }
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-3DHUF2DC-KN6O7WSA.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-7IDZTNVZ-HVRWIXYW.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -5243,7 +5249,7 @@ async function runClaudeViaPty(params) {
   });
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-3DHUF2DC-KN6O7WSA.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-7IDZTNVZ-HVRWIXYW.js");
   return agentManager2;
 }
 function createClaudeStreamState() {
@@ -5816,7 +5822,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager3() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-3DHUF2DC-KN6O7WSA.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-7IDZTNVZ-HVRWIXYW.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -10020,6 +10026,228 @@ var utilityRouter = router({
     return { waited: input.ms };
   })
 });
+var SCOPE_SCHEMA = z22.union([
+  z22.literal("global"),
+  z22.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
+]);
+var REL_PATH_SCHEMA = z22.string().min(1).max(512).regex(/^[A-Za-z0-9_./-]+$/).refine((p) => !p.includes("..") && !p.startsWith("/"), {
+  message: "Path must be a relative path without traversal"
+});
+var MAX_FILES = 500;
+var MAX_DEPTH = 8;
+var MAX_FILE_BYTES = 2e6;
+var IGNORED_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  ".next",
+  ".turbo",
+  ".cache",
+  "coverage",
+  ".yarn",
+  ".pnpm-store",
+  "target",
+  "out"
+]);
+var DocsEntrySchema = z22.lazy(() => z22.union([
+  z22.object({ type: z22.literal("file"), name: z22.string(), path: z22.string() }),
+  z22.object({ type: z22.literal("dir"), name: z22.string(), path: z22.string(), children: z22.array(DocsEntrySchema) })
+]));
+async function resolveScope(scope) {
+  if (scope === "global") {
+    const settings = await settingsManager.getSettings();
+    const sub = (settings.globalDocsPath?.trim() || "wiki").replace(/^[\\/]+|[\\/]+$/g, "");
+    if (sub.includes("..") || sub.includes("\0")) {
+      throw new TRPCError18({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
+    }
+    const dataDirAbs = resolvePath(env.DATA_DIR);
+    await mkdir13(dataDirAbs, { recursive: true });
+    const base = dirname3(await realpath(dataDirAbs));
+    const target = resolvePath(base, sub);
+    if (target !== base && !(target + sep3).startsWith(base + sep3)) {
+      throw new TRPCError18({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
+    }
+    await mkdir13(target, { recursive: true });
+    const root = await realpath(target);
+    if (root !== base && !(root + sep3).startsWith(base + sep3)) {
+      throw new TRPCError18({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
+    }
+    return { mode: "local", root };
+  }
+  const serviceId = scope.slice("service:".length);
+  const service = await serviceStore.get(serviceId);
+  if (!service) throw new TRPCError18({ code: "NOT_FOUND", message: "Service introuvable" });
+  const agentId = await resolveEffectiveAgentId(service);
+  if (!agentId) throw new TRPCError18({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
+  const cwd = (service.docsPath?.trim() || service.cwd || ".").toString();
+  return { mode: "agent", agentId, cwd };
+}
+async function walkLocal(root, dir, depth, counter) {
+  if (depth > MAX_DEPTH || counter.n >= MAX_FILES) return [];
+  let entries;
+  try {
+    entries = await readdir4(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries) {
+    if (counter.n >= MAX_FILES) break;
+    if (e.name.startsWith(".") && e.name !== ".") continue;
+    const abs = join14(dir, e.name);
+    const rel = relative(root, abs).split(sep3).join("/");
+    if (e.isDirectory()) {
+      if (IGNORED_DIRS.has(e.name)) continue;
+      const children = await walkLocal(root, abs, depth + 1, counter);
+      out.push({ type: "dir", name: e.name, path: rel, children });
+    } else if (e.isFile() && /\.(md|markdown)$/i.test(e.name)) {
+      counter.n += 1;
+      out.push({ type: "file", name: e.name, path: rel });
+    }
+  }
+  out.sort((a, b) => {
+    if (a.type !== b.type) return a.type === "dir" ? -1 : 1;
+    return a.name.localeCompare(b.name);
+  });
+  return out;
+}
+async function resolveSafeLocal(root, relPath, requireExist) {
+  if (relPath.includes("..") || relPath.startsWith("/")) {
+    throw new TRPCError18({ code: "BAD_REQUEST", message: "Chemin invalide" });
+  }
+  const target = resolvePath(root, relPath);
+  if (requireExist) {
+    let real;
+    try {
+      real = await realpath(target);
+    } catch {
+      throw new TRPCError18({ code: "NOT_FOUND", message: "Chemin introuvable" });
+    }
+    if (real !== root && !(real + sep3).startsWith(root + sep3)) {
+      throw new TRPCError18({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+    }
+    return real;
+  }
+  const parent = dirname3(target);
+  let realParent;
+  try {
+    realParent = await realpath(parent);
+  } catch {
+    realParent = parent;
+  }
+  if (realParent !== root && !(realParent + sep3).startsWith(root + sep3)) {
+    throw new TRPCError18({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+  }
+  return resolvePath(realParent, target.slice(parent.length).replace(/^[\\/]+/, ""));
+}
+var wikiRouter = router({
+  list: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA })).output(z22.object({ root: z22.string(), entries: z22.array(DocsEntrySchema), truncated: z22.boolean() })).query(async ({ input }) => {
+    const target = await resolveScope(input.scope);
+    if (target.mode === "agent") {
+      return agentManager.agentQuery(target.agentId, "wiki.listRepoMarkdown", { cwd: target.cwd });
+    }
+    const counter = { n: 0 };
+    const entries = await walkLocal(target.root, target.root, 0, counter);
+    return { root: target.root, entries, truncated: counter.n >= MAX_FILES };
+  }),
+  read: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).output(z22.object({ path: z22.string(), content: z22.string() })).query(async ({ input }) => {
+    if (!/\.(md|markdown)$/i.test(input.path)) {
+      throw new TRPCError18({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+    }
+    const target = await resolveScope(input.scope);
+    if (target.mode === "agent") {
+      return agentManager.agentQuery(target.agentId, "wiki.readRepoMarkdown", { cwd: target.cwd, path: input.path });
+    }
+    const file = await resolveSafeLocal(target.root, input.path, true);
+    const s = await stat3(file);
+    if (!s.isFile()) throw new TRPCError18({ code: "BAD_REQUEST", message: "Pas un fichier" });
+    if (s.size > MAX_FILE_BYTES) throw new TRPCError18({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
+    const content = await readFile12(file, "utf-8");
+    return { path: input.path, content };
+  }),
+  write: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z22.string().max(5e6) })).mutation(async ({ input }) => {
+    if (!/\.(md|markdown)$/i.test(input.path)) {
+      throw new TRPCError18({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+    }
+    const target = await resolveScope(input.scope);
+    if (target.mode === "agent") {
+      return agentManager.agentMutation(target.agentId, "wiki.writeMarkdown", { cwd: target.cwd, path: input.path, content: input.content });
+    }
+    const file = await resolveSafeLocal(target.root, input.path, false);
+    await mkdir13(dirname3(file), { recursive: true });
+    await writeFile10(file, input.content, "utf-8");
+    return { path: input.path, ok: true };
+  }),
+  createFile: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+    if (!/\.(md|markdown)$/i.test(input.path)) {
+      throw new TRPCError18({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+    }
+    const target = await resolveScope(input.scope);
+    if (target.mode === "agent") {
+      return agentManager.agentMutation(target.agentId, "wiki.createFile", { cwd: target.cwd, path: input.path });
+    }
+    const file = await resolveSafeLocal(target.root, input.path, false);
+    try {
+      await stat3(file);
+      throw new TRPCError18({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
+    } catch (err) {
+      if (err instanceof TRPCError18) throw err;
+    }
+    await mkdir13(dirname3(file), { recursive: true });
+    await writeFile10(file, "", "utf-8");
+    return { path: input.path, ok: true };
+  }),
+  createDir: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+    const target = await resolveScope(input.scope);
+    if (target.mode === "agent") {
+      return agentManager.agentMutation(target.agentId, "wiki.createDir", { cwd: target.cwd, path: input.path });
+    }
+    const dir = await resolveSafeLocal(target.root, input.path, false);
+    await mkdir13(dir, { recursive: true });
+    return { path: input.path, ok: true };
+  }),
+  rename: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+    const target = await resolveScope(input.scope);
+    if (target.mode === "agent") {
+      return agentManager.agentMutation(target.agentId, "wiki.renamePath", { cwd: target.cwd, fromPath: input.fromPath, toPath: input.toPath });
+    }
+    const from = await resolveSafeLocal(target.root, input.fromPath, true);
+    const to = await resolveSafeLocal(target.root, input.toPath, false);
+    try {
+      await stat3(to);
+      throw new TRPCError18({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
+    } catch (err) {
+      if (err instanceof TRPCError18) throw err;
+    }
+    await mkdir13(dirname3(to), { recursive: true });
+    await rename9(from, to);
+    return { fromPath: input.fromPath, toPath: input.toPath, ok: true };
+  }),
+  ensureRoot: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA })).mutation(async ({ input }) => {
+    if (input.scope === "global") {
+      await resolveScope("global");
+      return { ok: true };
+    }
+    const serviceId = input.scope.slice("service:".length);
+    const service = await serviceStore.get(serviceId);
+    if (!service) throw new TRPCError18({ code: "NOT_FOUND", message: "Service introuvable" });
+    const agentId = await resolveEffectiveAgentId(service);
+    if (!agentId) throw new TRPCError18({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
+    const cwd = (service.docsPath?.trim() || service.cwd || ".").toString();
+    return agentManager.agentMutation(agentId, "wiki.ensureRoot", { cwd });
+  }),
+  delete: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+    const target = await resolveScope(input.scope);
+    if (target.mode === "agent") {
+      return agentManager.agentMutation(target.agentId, "wiki.deletePath", { cwd: target.cwd, path: input.path });
+    }
+    const fp = await resolveSafeLocal(target.root, input.path, true);
+    if (fp === target.root) throw new TRPCError18({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
+    await rm2(fp, { recursive: true, force: true });
+    return { path: input.path, ok: true };
+  })
+});
 var appRouter = router({
   health: healthRouter,
   project: projectRouter,
@@ -10039,7 +10267,8 @@ var appRouter = router({
   kanban: kanbanRouter,
   kanbanQueue: kanbanQueueRouter,
   terminal: terminalRouter,
-  utility: utilityRouter
+  utility: utilityRouter,
+  wiki: wikiRouter
 });
 function errorHandler(err, _req, res, _next) {
   console.error("[server] Unhandled error:", err);
@@ -10079,9 +10308,9 @@ var SENSITIVE_FILES = [
 var SECURE_MODE = 384;
 async function ensureFilePermissions() {
   for (const filename of SENSITIVE_FILES) {
-    const filepath = join14(env.DATA_DIR, filename);
+    const filepath = join15(env.DATA_DIR, filename);
     try {
-      const stats = await stat3(filepath);
+      const stats = await stat4(filepath);
       const mode = stats.mode & 511;
       if (mode !== SECURE_MODE) {
         console.warn("[security] File", filename, "has mode", mode.toString(8) + ", fixing to 600");
@@ -10127,8 +10356,8 @@ conversations.private.json
 *.log.*
 `;
 async function ensureDataGitignore(dataDir) {
-  const gitignorePath = join15(dataDir, ".gitignore");
-  await writeFile10(gitignorePath, GITIGNORE_CONTENT, "utf-8");
+  const gitignorePath = join16(dataDir, ".gitignore");
+  await writeFile11(gitignorePath, GITIGNORE_CONTENT, "utf-8");
 }
 var _require = createRequire(import.meta.url);
 var PARSER_ID_MAP = {
@@ -10236,7 +10465,7 @@ async function getSodium() {
   return _sodium;
 }
 async function decryptLegacyFile(filePath, key, sodium) {
-  const raw = (await readFile12(filePath, "utf-8")).trim();
+  const raw = (await readFile13(filePath, "utf-8")).trim();
   if (!raw || raw === "[]" || raw === "{}") {
     try {
       return JSON.parse(raw);
@@ -10256,14 +10485,14 @@ async function decryptLegacyFile(filePath, key, sodium) {
 }
 async function atomicWrite(path, data) {
   const tmp = path + ".tmp";
-  await writeFile11(tmp, JSON.stringify(data, null, 2), "utf-8");
-  await rename9(tmp, path);
+  await writeFile12(tmp, JSON.stringify(data, null, 2), "utf-8");
+  await rename10(tmp, path);
 }
 async function runLegacyMigration(dataDir) {
   const { resolve: resolve5 } = await import("path");
   const abCwd = resolve5(process.cwd());
-  const legacyRoot = join16(abCwd, env.DATA_DIR);
-  const legacyKeyPath = join16(legacyRoot, "dbs", "encryption-key.json");
+  const legacyRoot = join17(abCwd, env.DATA_DIR);
+  const legacyKeyPath = join17(legacyRoot, "dbs", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
   } catch {
@@ -10271,20 +10500,20 @@ async function runLegacyMigration(dataDir) {
   }
   console.log("[legacy-migration] Legacy Runeya data detected, starting migration\u2026");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const legacyTmp = join16(abCwd, ".runeya-tmp");
-  await rename9(legacyRoot, legacyTmp);
-  await mkdir13(dataDir, { recursive: true });
-  const legacyOld = join16(dataDir, `backup-${timestamp}`);
-  await rename9(legacyTmp, legacyOld);
+  const legacyTmp = join17(abCwd, ".runeya-tmp");
+  await rename10(legacyRoot, legacyTmp);
+  await mkdir14(dataDir, { recursive: true });
+  const legacyOld = join17(dataDir, `backup-${timestamp}`);
+  await rename10(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
-  const keyJson = JSON.parse(await readFile12(join16(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
+  const keyJson = JSON.parse(await readFile13(join17(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
   const sodiumKey = sodium.from_base64(keyJson.encryptionKey);
   const keyBuffer = Buffer.from(sodiumKey);
   const runyeaKeyHex = keyBuffer.toString("hex");
   await setEncryptionKey(runyeaKeyHex);
   console.log("[legacy-migration] Encryption key loaded in memory (temporary)");
-  const dbsDir = join16(legacyOld, "dbs");
+  const dbsDir = join17(legacyOld, "dbs");
   async function readEncrypted(filePath) {
     try {
       return await decryptLegacyFile(filePath, sodiumKey, sodium);
@@ -10293,29 +10522,29 @@ async function runLegacyMigration(dataDir) {
       return null;
     }
   }
-  const envsDir = join16(dbsDir, "envs");
-  const envFiles = (await readdir4(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const envsDir = join17(dbsDir, "envs");
+  const envFiles = (await readdir5(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyEnvs = {};
   for (const file of envFiles) {
     const name = file.replace(".encrypted.json", "");
-    legacyEnvs[name] = await readEncrypted(join16(envsDir, file));
+    legacyEnvs[name] = await readEncrypted(join17(envsDir, file));
   }
-  const servicesDir = join16(dbsDir, "services");
-  const serviceFiles = (await readdir4(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const servicesDir = join17(dbsDir, "services");
+  const serviceFiles = (await readdir5(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServices = {};
   for (const file of serviceFiles) {
     const name = file.replace(".encrypted.json", "");
     if (!name) continue;
-    const data = await readEncrypted(join16(servicesDir, file));
+    const data = await readEncrypted(join17(servicesDir, file));
     if (data?.label) legacyServices[name] = data;
   }
-  const overridesDir = join16(dbsDir, "overrides");
-  const overrideFiles = (await readdir4(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const overridesDir = join17(dbsDir, "overrides");
+  const overrideFiles = (await readdir5(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServiceOverrides = {};
   const legacyEnvOverrides = {};
   for (const file of overrideFiles) {
     const baseName = file.replace(".encrypted.json", "");
-    const data = await readEncrypted(join16(overridesDir, file));
+    const data = await readEncrypted(join17(overridesDir, file));
     if (!data) continue;
     if (baseName.endsWith("-envs")) {
       legacyServiceOverrides[baseName.slice(0, -5)] = data;
@@ -10323,11 +10552,11 @@ async function runLegacyMigration(dataDir) {
       legacyEnvOverrides[baseName.slice(0, -12)] = data;
     }
   }
-  const parsersDir = join16(dbsDir, "parsers");
-  const parserFiles = (await readdir4(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const parsersDir = join17(dbsDir, "parsers");
+  const parserFiles = (await readdir5(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyParsers = [];
   for (const file of parserFiles) {
-    const data = await readEncrypted(join16(parsersDir, file));
+    const data = await readEncrypted(join17(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
   const projectMonoId = randomUUID10();
@@ -10668,7 +10897,7 @@ async function runLegacyMigration(dataDir) {
   }
   let existingSettings = {};
   try {
-    existingSettings = JSON.parse(await readFile12(join16(dataDir, "settings.json"), "utf-8"));
+    existingSettings = JSON.parse(await readFile13(join17(dataDir, "settings.json"), "utf-8"));
   } catch {
   }
   const migratedParsers = legacyParsers.map((p) => ({
@@ -10689,11 +10918,11 @@ ${p.transform ?? ""}`,
       ...migratedParsers
     ]
   };
-  await atomicWrite(join16(dataDir, "projects.json"), runeProjects);
-  await atomicWrite(join16(dataDir, "services.json"), runeServices);
-  await atomicWrite(join16(dataDir, "environments.json"), runeEnvs);
-  await atomicWrite(join16(dataDir, "environment-overrides.json"), flatOverrides);
-  await atomicWrite(join16(dataDir, "settings.json"), newSettings);
+  await atomicWrite(join17(dataDir, "projects.json"), runeProjects);
+  await atomicWrite(join17(dataDir, "services.json"), runeServices);
+  await atomicWrite(join17(dataDir, "environments.json"), runeEnvs);
+  await atomicWrite(join17(dataDir, "environment-overrides.json"), flatOverrides);
+  await atomicWrite(join17(dataDir, "settings.json"), newSettings);
   const svcEnvCount = runeEnvs.filter((e) => e.scope === "service").length;
   console.log(`[legacy-migration] Written: ${runeProjects.length} projects, ${runeServices.length} services, ${runeEnvs.length} environments (${svcEnvCount} service-scoped)`);
   console.log(`[legacy-migration] Overrides: ${Object.keys(flatOverrides).length}, custom parsers: ${migratedParsers.length} (all disabled \u2014 rewrite required)`);
@@ -10704,12 +10933,12 @@ ${p.transform ?? ""}`,
 }
 async function findLegacyKeyInBackup(dataDir) {
   try {
-    const entries = await readdir4(dataDir);
+    const entries = await readdir5(dataDir);
     const backupDirs = entries.filter((e) => e.startsWith("backup-")).sort().reverse();
     for (const dir of backupDirs) {
-      const keyJsonPath = join16(dataDir, dir, "dbs", "encryption-key.json");
+      const keyJsonPath = join17(dataDir, dir, "dbs", "encryption-key.json");
       try {
-        const raw = await readFile12(keyJsonPath, "utf-8");
+        const raw = await readFile13(keyJsonPath, "utf-8");
         const parsed = JSON.parse(raw);
         if (!parsed.encryptionKey) continue;
         const sodium = await getSodium();
@@ -10731,14 +10960,14 @@ async function runOverrideOnlyMigration(dataDir) {
   const abDataDir = resolve5(dataDir);
   const abCwd = resolve5(process.cwd());
   const candidateDirs = [
-    join16(abCwd, ".runeya", "dbs", "overrides"),
-    join16(abDataDir, "dbs", "overrides")
+    join17(abCwd, ".runeya", "dbs", "overrides"),
+    join17(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
   let overrideFiles = [];
   for (const dir of candidateDirs) {
     try {
-      const files = (await readdir4(dir)).filter((f) => f.endsWith(".encrypted.json"));
+      const files = (await readdir5(dir)).filter((f) => f.endsWith(".encrypted.json"));
       if (files.length > 0) {
         overridesDir = dir;
         overrideFiles = files;
@@ -10748,7 +10977,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (!overridesDir || overrideFiles.length === 0) return false;
-  const legacyKeyPath = join16(overridesDir, "..", "encryption-key.json");
+  const legacyKeyPath = join17(overridesDir, "..", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
     return false;
@@ -10766,7 +10995,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const envNameToId = {};
   let envsRaw;
   try {
-    envsRaw = JSON.parse(await readFile12(join16(abDataDir, "environments.json"), "utf-8"));
+    envsRaw = JSON.parse(await readFile13(join17(abDataDir, "environments.json"), "utf-8"));
     for (const _env of envsRaw) {
       const env2 = _env;
       if (env2["name"] && env2["id"]) {
@@ -10785,7 +11014,7 @@ async function runOverrideOnlyMigration(dataDir) {
   let servicesRaw = [];
   const serviceNameToId = {};
   try {
-    servicesRaw = JSON.parse(await readFile12(join16(abDataDir, "services.json"), "utf-8"));
+    servicesRaw = JSON.parse(await readFile13(join17(abDataDir, "services.json"), "utf-8"));
     for (const _svc of servicesRaw) {
       const svc = _svc;
       if (svc["name"] && svc["id"]) serviceNameToId[svc["name"]] = svc["id"];
@@ -10802,7 +11031,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const envName = baseName.slice(0, -"-environment".length);
     let data;
     try {
-      data = await decryptLegacyFile(join16(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join17(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -10829,7 +11058,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (Object.keys(flatOverrides).length > 0) {
-    await atomicWrite(join16(abDataDir, "environment-overrides.json"), flatOverrides);
+    await atomicWrite(join17(abDataDir, "environment-overrides.json"), flatOverrides);
     console.log(`[override-migration] Written ${Object.keys(flatOverrides).length} override(s) to environment-overrides.json`);
   }
   let envsModified = false;
@@ -10839,7 +11068,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const serviceName = baseName.slice(0, -"-envs".length);
     let data;
     try {
-      data = await decryptLegacyFile(join16(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join17(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -10898,12 +11127,12 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (envsModified) {
-    await atomicWrite(join16(abDataDir, "environments.json"), envsRaw);
+    await atomicWrite(join17(abDataDir, "environments.json"), envsRaw);
     console.log("[override-migration] Merged service overrides into environments.json");
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
   try {
-    await rename9(overridesDir, migratedDir);
+    await rename10(overridesDir, migratedDir);
     console.log(`[override-migration] Moved overrides/ \u2192 overrides-migrated/`);
   } catch (err) {
     console.warn(`[override-migration] Could not rename overrides dir: ${err.message}`);
@@ -10920,9 +11149,9 @@ var CANARY_PLAINTEXT = "runeya:v1:key-verification";
 var MAX_KEY_FILE_SIZE = 1024;
 var ARGON2_OPTIONS = { memoryCost: 65536, timeCost: 3, parallelism: 4, outputLen: 32 };
 async function readKeyFile(filePath) {
-  const s = await stat4(filePath);
+  const s = await stat5(filePath);
   if (s.size > MAX_KEY_FILE_SIZE) throw new Error(`Fichier suspect : ${filePath} (${s.size} octets)`);
-  return readFile13(filePath);
+  return readFile14(filePath);
 }
 function aesEncrypt(key, plaintext) {
   const iv = randomBytes4(12);
@@ -10941,7 +11170,7 @@ function aesDecrypt(key, data) {
 }
 async function getPepperFromFile(dataDir) {
   try {
-    const raw = await readKeyFile(join17(dataDir, PEPPER_FILENAME));
+    const raw = await readKeyFile(join18(dataDir, PEPPER_FILENAME));
     const hex = raw.toString("utf-8").trim();
     if (/^[0-9a-f]{64}$/i.test(hex)) return Buffer.from(hex, "hex");
   } catch {
@@ -10949,11 +11178,11 @@ async function getPepperFromFile(dataDir) {
   return null;
 }
 async function writePepperToFile(dataDir, pepper) {
-  const filePath = join17(dataDir, PEPPER_FILENAME);
+  const filePath = join18(dataDir, PEPPER_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile12(tmpPath, pepper.toString("hex"), "utf-8");
+  await writeFile13(tmpPath, pepper.toString("hex"), "utf-8");
   await chmod9(tmpPath, 384);
-  await rename10(tmpPath, filePath);
+  await rename11(tmpPath, filePath);
 }
 function tryKeyringGet() {
   try {
@@ -11000,14 +11229,14 @@ async function writeEncryptedKey(dataDir, masterPassword, encryptionKey) {
   const payload = aesEncrypt(derivedKey, encryptionKey);
   const fileContent = Buffer.concat([salt, payload]);
   const encoded = fileContent.toString("base64");
-  const filePath = join17(dataDir, ENCRYPTED_KEY_FILENAME);
+  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile12(tmpPath, encoded, "utf-8");
+  await writeFile13(tmpPath, encoded, "utf-8");
   await chmod9(tmpPath, 384);
-  await rename10(tmpPath, filePath);
+  await rename11(tmpPath, filePath);
 }
 async function readEncryptedKey(dataDir, masterPassword) {
-  const filePath = join17(dataDir, ENCRYPTED_KEY_FILENAME);
+  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
   const raw = await readKeyFile(filePath);
   const fileContent = Buffer.from(raw.toString("utf-8").trim(), "base64");
   const salt = fileContent.subarray(0, 16);
@@ -11027,13 +11256,13 @@ async function getPepperFromKeychain(dataDir) {
 }
 async function writeVerifyFile(dataDir, encryptionKey) {
   const payload = aesEncrypt(encryptionKey, Buffer.from(CANARY_PLAINTEXT, "utf-8"));
-  const filePath = join17(dataDir, VERIFY_FILENAME);
+  const filePath = join18(dataDir, VERIFY_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile12(tmpPath, payload.toString("base64"), "utf-8");
-  await rename10(tmpPath, filePath);
+  await writeFile13(tmpPath, payload.toString("base64"), "utf-8");
+  await rename11(tmpPath, filePath);
 }
 async function verifyEncryptionKey(dataDir, encryptionKey) {
-  const filePath = join17(dataDir, VERIFY_FILENAME);
+  const filePath = join18(dataDir, VERIFY_FILENAME);
   const raw = await readKeyFile(filePath);
   const payload = Buffer.from(raw.toString("utf-8").trim(), "base64");
   const plaintext = aesDecrypt(encryptionKey, payload);
@@ -11043,7 +11272,7 @@ async function verifyEncryptionKey(dataDir, encryptionKey) {
 }
 async function hasVerifyFile(dataDir) {
   try {
-    await stat4(join17(dataDir, VERIFY_FILENAME));
+    await stat5(join18(dataDir, VERIFY_FILENAME));
     return true;
   } catch {
     return false;
@@ -11051,7 +11280,7 @@ async function hasVerifyFile(dataDir) {
 }
 async function hasEncryptedKeyFile(dataDir) {
   try {
-    await stat4(join17(dataDir, ENCRYPTED_KEY_FILENAME));
+    await stat5(join18(dataDir, ENCRYPTED_KEY_FILENAME));
     return true;
   } catch {
     return false;
@@ -11065,17 +11294,17 @@ async function getServerState() {
   let hasVerify = false;
   let hasData = false;
   try {
-    await stat5(join18(dataDir, ENCRYPTED_KEY_FILENAME2));
+    await stat6(join19(dataDir, ENCRYPTED_KEY_FILENAME2));
     hasEncFile = true;
   } catch {
   }
   try {
-    await stat5(join18(dataDir, VERIFY_FILENAME2));
+    await stat6(join19(dataDir, VERIFY_FILENAME2));
     hasVerify = true;
   } catch {
   }
   try {
-    await stat5(join18(dataDir, "projects.json"));
+    await stat6(join19(dataDir, "projects.json"));
     hasData = true;
   } catch {
   }
@@ -11461,7 +11690,7 @@ async function createLocalServer() {
       console.log("[server] Premier lancement \u2014 setup requis");
     }
   }
-  if (!existsSync2(env.DATA_DIR)) await mkdir14(env.DATA_DIR);
+  if (!existsSync2(env.DATA_DIR)) await mkdir15(env.DATA_DIR);
   const absoluteDataDir = resolve4(env.DATA_DIR);
   console.log(`[server] Data directory: ${absoluteDataDir}`);
   await ensureDataGitignore(env.DATA_DIR);
@@ -11929,7 +12158,7 @@ async function pullEnv(opts) {
 }
 dotenv.config({ quiet: true });
 if (process.env["DATA_DIR"]) {
-  const resolved = resolvePath(process.env["DATA_DIR"], "..");
+  const resolved = resolvePath2(process.env["DATA_DIR"], "..");
   process.chdir(resolved);
   console.log(`[server] Working directory: ${resolved} (from DATA_DIR)`);
 }
@@ -12002,4 +12231,4 @@ export {
   createLocalServer,
   pullEnv
 };
-//# sourceMappingURL=dist-TI3HFRUW.js.map
+//# sourceMappingURL=dist-CJTJWMCR.js.map